Security researchers at Anthropic have built an exploit for a critical Linux kernel vulnerability, CVE-2026-98432, that lets unauthenticated attackers execute commands as root on servers running Multipath TCP (MPTCP) listeners. The use-after-free flaw resides in the kernel’s IPv4 TCP code and received a 9.8 severity score from the Linux kernel CVE team. It affects kernels back to version 4.4, including Ubuntu, Red Hat Enterprise Linux (RHEL) and Rocky Linux. While Red Hat rates it as a potential denial-of-service issue (score 5.9), Anthropic demonstrated remote code execution in about 53 minutes by bypassing KASLR on an MPTCP-enabled server. Patches have been applied upstream and back-ported, but Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, as well as RHEL 8-10, still await updates. CIQ suggests temporary firewall rules to block IPv4 TCP packets with IP options, noting that disabling MPTCP alone is insufficient. 1